[ChiragAgg5k]

What

Fixes Dependabot alert GHSA-mrhx-c7xc-m3w5 (high): zod < 4.6.6 can exhaust memory while validating oversized constrained collections.

zod is transitive only, through @tanstack/router-plugin, @tanstack/router-generator and @tanstack/start-plugin-core, which all declare zod: ^4.5.4. The patched version is already inside that range, so no parent bump or overrides entry is needed. npm update zod --package-lock-only moves the lock from 4.6.5 to 4.6.7.

Re-resolving the lockfile also adds node_modules/nitro/node_modules/lru-cache@11.5.3. That entry was missing on main, which is why npm ci, and so CI on main, fails with Missing: lru-cache@11.5.3 from lock file.

Verification

• npm ci succeeds
• npm ls zod shows only zod@4.6.7
• npm run build succeeds

[hansi-codes]

🟢 Tier S · Ready to merge

The locked install and production build pass, and Zod is resolved only at the patched 4.6.7 version.

Updates the transitive Zod lock entry from 4.6.5 to 4.6.7, including the constrained-collection validation fix. Adds Nitro’s previously missing nested lru-cache@11.5.3 lock entry.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 1

File	Change
package-lock.json	Bumps Zod and records the nested lru-cache dependency for Nitro.

---

_{Reviewed e0ba2f9 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary